# Software Vendor Registry
URL: https://docs.autociso.io/console/supply-chain/vendors/
Description: The Vendor Registry lists the software vendors you depend on, with a risk tier and the status of your security assessment of each. It supports your third-party risk management.

*This is the help text the console shows in the help panel on this page.*

The Vendor Registry lists the software vendors you depend on, with a risk tier and the status of your [security assessment](https://docs.autociso.io/product/suppliers/assessments/) of each. It supports your [third-party risk management](https://docs.autociso.io/console/directory/suppliers/).

### What You Track
- **Vendor name, Website and Type**: Open Source, Commercial or Internal.
- **Risk tier**: Tier 1 — Critical, Tier 2 — High or Tier 3 — Standard, based on the vendor's access to data and how critical the system is to you.
- **Assessment status**: Not Started, In Progress or Completed.
- **Open findings**: The number of [open vulnerability findings](https://docs.autociso.io/console/supply-chain/findings/) tied to the vendor.
- **Notes**: Context about the vendor's security posture, contracts or SLAs.

### Using the Registry
- Click **Add Vendor** to create an entry; use the search box to find one. [Members and system managers](https://docs.autociso.io/getting-started/roles-and-permissions/) have read-only access.
- During a high-profile supply chain attack (like Log4j), search the registry to see which vendors you track and how critical each is.
- Supports [ISO 27001 supplier and ICT supply chain controls](https://docs.autociso.io/console/iso/soa/) (for example A.5.21).